This detection identifies adversary activity involving newly discovered ELF (Executable and Linkable Format) malware distributed through malicious URLs, which often serve as initial infection vectors for Windows-based systems. Proactively hunting for these specific URL patterns in Azure Sentinel is critical to intercept early-stage threats before they execute payloads that could compromise endpoint integrity or facilitate lateral movement within the network.
Threat: elf Total URLs: 30 Active URLs: 21
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://94.154.43.238/bins/m68k | online | malware_download | 2026-08-03 |
hxxp://94.154.43.238/bins/mpsl | online | malware_download | 2026-08-03 |
hxxp://94.154.43.238/bins/mips | online | malware_download | 2026-08-03 |
hxxp://94.154.43.238/bins/sh4 | online | malware_download | 2026-08-03 |
hxxp://94.154.43.238/bins/i686 | online | malware_download | 2026-08-03 |
hxxp://94.154.43.238/bins/spc | online | malware_download | 2026-08-03 |
hxxp://94.154.43.238/bins/x86_64 | online | malware_download | 2026-08-03 |
hxxp://94.154.43.238/bins/ppc | online | malware_download | 2026-08-03 |
hxxp://94.154.43.238/bins/x86 | online | malware_download | 2026-08-03 |
hxxp://94.154.43.238/bins/dbg | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/x86_64 | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/spc | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/dbg | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/i686 | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/m68k | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/sh4 | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/x86 | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/mpsl | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/ppc | online | malware_download | 2026-08-03 |
hxxp://193.233.82.82/bins/mips | online | malware_download | 2026-08-03 |
hxxp://204.10.194.60/xlumen/lkxstress.spc | offline | malware_download | 2026-08-03 |
hxxp://204.10.194.60/xlumen/lkxstress.mpsl | offline | malware_download | 2026-08-03 |
hxxp://204.10.194.60/xlumen/lkxstress.x86 | offline | malware_download | 2026-08-03 |
hxxp://204.10.194.60/xlumen/lkxstress.i686 | offline | malware_download | 2026-08-03 |
hxxp://204.10.194.60/xlumen/lkxstress.sh4 | offline | malware_download | 2026-08-03 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["94.154.43.238", "193.233.82.82", "31.77.227.111"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.238", "193.233.82.82", "31.77.227.111"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, along with targeted exclusion strategies:
Scenario: Automated Software Update Scans by Endpoint Protection Agents
https://urlhaus-files.malware.com domain (or similar feed endpoints) to fetch the latest ELF binary threat intelligence signatures. These agents often generate high-volume traffic containing URLs tagged as “elf” that are part of their normal update cycle, not actual malicious activity.process_name matches known security agents (e.g., C:\Program Files\CrowdStrike\fsqa.exe, msdt.exe, Symantec Endpoint Protection Client).Scenario: Scheduled Backup and Archiving Jobs Accessing Cloud Repositories
02:00 - 04:00 UTC) combined with an Application Name filter. Exclude traffic from backup tools like Veeam Backup & Replication, Rubrik, or specific Ansible runner processes (ansible-runner.exe).Scenario: **Internal DevOps Pipeline Artifact Retrie